CVE-2025-60205: ThemeREX Addons Auth Bypass Vulnerability

CVE-2025-60205 Overview

CVE-2025-60205 is an unauthenticated PHP Object Injection vulnerability in the ThemeREX Addons WordPress plugin, affecting all versions up to and including 2.36.1.1. The flaw allows remote attackers to inject crafted serialized PHP objects without authentication. When a suitable POP (Property-Oriented Programming) chain is present in the WordPress instance, exploitation can lead to remote code execution, arbitrary file operations, or full site compromise. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data and is documented in the Patchstack Vulnerability Analysis.

Critical Impact
Unauthenticated attackers can inject arbitrary PHP objects over the network, enabling remote code execution and full WordPress site takeover when gadget chains are reachable.

Affected Products

ThemeREX Addons plugin for WordPress, versions <= 2.36.1.1
WordPress sites bundling the ThemeREX Addons (trx_addons) plugin via ThemeREX premium themes
Any installation exposing plugin endpoints that pass user-controlled data to unserialize()

Discovery Timeline

2026-06-17 - CVE-2025-60205 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60205

Vulnerability Analysis

The vulnerability resides in the ThemeREX Addons plugin (trx_addons), which exposes functionality consumed by ThemeREX commercial themes. Affected code paths pass attacker-controlled input into PHP's unserialize() function without sufficient validation. Because the entry point does not require authentication, any remote user can submit a request containing a serialized payload.

PHP Object Injection becomes exploitable when the target application or its loaded plugins contain magic methods such as __wakeup(), __destruct(), __toString(), or __call() that perform sensitive operations. WordPress core and popular plugins are known to expose multiple gadget chains, which means the impact extends well beyond the plugin itself. Attackers chain these gadgets to write files, execute arbitrary PHP, or manipulate database state.

Root Cause

The root cause is unsafe deserialization of untrusted input [CWE-502]. The plugin accepts serialized data from HTTP parameters and reconstructs PHP objects without restricting allowed classes or validating the structure. A safer implementation would use json_decode() or pass the allowed_classes option to unserialize() to restrict object instantiation.

Attack Vector

The attack is delivered over the network against the WordPress site, with no privileges or user interaction required. An attacker crafts a serialized PHP object payload that triggers a gadget chain available in WordPress core or installed plugins. The payload is sent to a vulnerable plugin endpoint, where it is deserialized server-side. When the resulting object is destroyed or otherwise accessed, the chain executes, producing effects ranging from file write to remote code execution. Refer to the Patchstack Vulnerability Analysis for technical details.

Detection Methods for CVE-2025-60205

Indicators of Compromise

HTTP requests to trx_addons AJAX or REST endpoints containing serialized PHP markers such as O:, a:, or s: in request parameters
Unexpected PHP files appearing under wp-content/uploads/ or theme directories after plugin requests
New or modified WordPress administrator accounts not tied to legitimate activity
wp-config.php, .htaccess, or plugin file modifications without a corresponding deployment event

Detection Strategies

Inspect web server access logs for POST/GET requests to ThemeREX Addons endpoints with serialized object signatures in parameter values
Enable PHP error logging and alert on unserialize() warnings or class instantiation errors from the trx_addons plugin path
Deploy file integrity monitoring across WordPress core, plugin, and theme directories to detect post-exploitation writes
Correlate plugin endpoint requests with subsequent outbound connections from the PHP worker process

Monitoring Recommendations

Track installed trx_addons versions across the estate and flag any instance at or below 2.36.1.1
Forward web server, PHP, and WordPress audit logs to a centralized analytics platform for behavioral correlation
Alert on creation of administrator users, plugin installations, or option changes outside maintenance windows

How to Mitigate CVE-2025-60205

Immediate Actions Required

Update the ThemeREX Addons plugin to a version above 2.36.1.1 as soon as the vendor publishes a fixed release
Restrict access to WordPress admin and AJAX endpoints from untrusted networks using a web application firewall
Audit WordPress sites for unauthorized administrator accounts, scheduled tasks, and modified plugin files
Rotate WordPress secrets in wp-config.php, database credentials, and API keys on any potentially exposed site

Patch Information

Review the Patchstack Vulnerability Analysis for current fix status and upgrade guidance. ThemeREX Addons is distributed through ThemeREX premium themes, so administrators should obtain the patched plugin build from the theme vendor rather than the public WordPress plugin repository.

Workarounds

Disable the ThemeREX Addons plugin until a patched version is installed if the site can operate without it
Apply WAF rules that block request parameters containing PHP serialization patterns such as O:\d+: or a:\d+:{
Limit plugin endpoint exposure to authenticated sessions where the theme allows
Place WordPress behind an authenticating reverse proxy for non-public environments

bash

# Example WAF rule pattern to block serialized PHP object payloads
# ModSecurity-style rule (adapt to your WAF syntax)
SecRule ARGS "@rx (?:^|[&=])(O|a|C):[0-9]+:\"" \
  "id:1060205,phase:2,deny,status:403,\
   msg:'Potential PHP Object Injection (CVE-2025-60205)',\
   tag:'CWE-502'"